Hawking H2WR54G

The Hawking H2WR54G is a dual-WAN SOHO gateway/router/AP based on the ADM5120 SoC (BGA). It has 2 WAN Ethernet ports and a 4 port LAN switch. The firmware contains the usual: Linux, Firewall, NAT, dhcp client and server, BusyBox, uClibc, etc. The ADM5120 runs in little-endian mode. Hawking's Linux kernel, like most of the Edimax-clone devices, is version 2.4.18.

Contents

Appearance

The appearance of the external case in the Hawking product link differs from earlier versions that were sold. This is what the case used to look like when the product was first introduced in 2004:

Althouth the case design has changed radically, the firmware downloads are compatible so it would be resonable to assume that they are identical on the inside.

USB Expansion Potential

Like the Planet XRT-402D and several Edimax models, there are places on the PCB for two USB connectors and associated electronics that are not populated. As with the Edimax BR6104KP, it may be possible to add the missing parts and achieve USB support. The ADM5120 implements USB version 1.1 only.

Circuit Board

The main circuit board is pictured here.

The space for the unpopulated USB connectors can be seen at the top of the board. At the bottom center you can see the 14-pin JTAG connector and the 8-pin serial port connector. If you take a look at the picture links for the Planet XRT-402D router you will see that the circuit boards are almost identical.

CPU & Memory

The ADM5120 SoC (System-On-Chip) and memory components are pictured here.

The ADM5120 is visible in this picture. Below and to the right of it the MX29LV320ABTC-90 flash memory chip can be seen. It is a bottom-boot 32 MBit device that is configurable as 2,097,152 x 16-bit words (4 MBytes). At the left are the two SDRAM chips. They are HY57V281620HCT devices; each is 128 Mbits internally organized as 4 banks of 2,097,152 x 16. Together they provide 32 MBytes of SDRAM.

MX29LV320AB Flash

Hawking has crippled the standard Edimax bootloader so that it will not download firmware directly to RAM and execute it. There's nothing you can do about it without special equipment since sector 0 on the flash device is "protected" and the only way to unprotect it is with a 12 volt input to the flash RESET pin. Although the AC power adapter supplies 12 VDC to the unit it is not made available inside the case. Even if it was available, would you really want to connect it directly to the RESET pin without knowing what else was connected to it on the circuit board?

WiFi mini-PCI Card

The Inprocomm wireless miniPCI card is pictured here.

The IPN2220 WiFi chip is provided with only a binary driver supplied as a kernel module, IPN2220AP.o. There is no native Linux source code for this driver, so unless you're willing to run ndiswrapper you are pretty much stuck with the Linux 2.4.18 kernel since modules compiled for one version of the kernel will not work with other versions.

Kernel Analysis

I've managed to compile my own 2.4.18 kernel using the Edimax source code and the Hawking initrd disk image files. It boots and runs but the Hawking scripts that manage the dual-WAN setup do not run properly. I'm pretty sure this is because of the dual-WAN nature of the H2WR54G. The Edimax source code does not account for this feature. In particular, the file

.../linux-2.4.18-adm/drivers/net/am5120sw/swdrv.c

defines the VLAN interfaces for the kernel. The Edimax source code has

static long vlan[MAX_VLAN_GROUP] = {0x5E, 0x41, 0, 0, 0, 0};

while the Hawking kernel was built with

static long vlan[MAX_VLAN_GROUP] = {0x41, 0x42, 0x7C, 0, 0, 0};

The kernel network code assigns each VLAN group to an ethernet device. For the Edimax code, the devices would be eth0 and eth1, while the Hawking code adds eth2 to the mix. This reflects the addition of the second WAN port. This information was only obtainable by examining the binary kernel in the Hawking firmware. There are undoubtedly more kernel changes, such as the one that prevents boot-time printk messages from appearing, that are extremely subtle and hard to pin down without access to the source code. It would be nice if someone would light a fire under Hawking or Planet to get them to release their source code, but it's hard to drum up interest in this since these are two minor vendors in the grand scheme of things.

Sergio Aguayo's AMiLDA Linux distro also runs on the H2WR54G. Vladislav Moskovets' Midge distro runs on it as well.

ADM5120 Switch

The ADM5120_switch page describes a utility to configure the VLANs managed by the ADM5120 Switch. The utility does not work on the H2WR54G router, either with the stock firmware kernel or a custom 2.4.18 kernel built from the Edimax source. AMiLDA is based on the 2.4.32 Linux kernel and the admswconfig utility does work when running AMiLDA.

Experimenting

After hooking up a serial port to the router and powering it on there is a distinct lack of output during the boot process. One up and running, the 'dmesg' command does not show any information. It appears as though Hawking has modified the kernel code somehow to turn off all printk output during the boot process. Replacing the firmware with a custom-built 2.4.18 kernel results in all the normal boot-time messages one would normally expect from Linux. Current experiments involve disassembling the Hawking Linux kernel to try and ascertain a way to patch it so that the boot-time messags are printed.

EJTAG

Work is now underway to see if a bricked H2WR54G can be brought back to life through the use of the JTAG connector on the PCB. An update will be posted once testing is complete.